/**
 * Bulk operations router — bulk-operations (wave-8 leaf 2).
 * Mounted at /api/bulk in apps/zync-api/src/routes/index.ts.
 *
 * Routes:
 *   POST /bulk/invoices/status    — bulk update invoice status
 *   POST /bulk/customers/archive  — bulk archive customers
 *   POST /bulk/expenses/delete    — bulk soft-delete expenses
 *   POST /bulk/projects/status    — bulk update project status
 */
import { Hono } from 'hono'
import type { AppEnv } from '../../types'
import { authMiddleware } from '../../middleware/auth'
import { requirePermission } from '../../middleware/guards'
import {
  bulkUpdateInvoiceStatus,
  bulkArchiveCustomers,
  bulkDeleteExpenses,
  bulkUpdateProjectStatus,
  bulkInvoiceStatusSchema,
  bulkCustomerArchiveSchema,
  bulkExpenseDeleteSchema,
  bulkProjectStatusSchema,
} from '@zync/db/queries'

// ── Router ────────────────────────────────────────────────────────────────────

export const bulkRoutes = new Hono<AppEnv>()

bulkRoutes.use('*', authMiddleware)

// ── POST /bulk/invoices/status ────────────────────────────────────────────────

bulkRoutes.post('/invoices/status', requirePermission('invoices:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = bulkInvoiceStatusSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const countryCode =
    'countryCode' in session && typeof session.countryCode === 'string'
      ? session.countryCode
      : 'IL'

  const db = c.get('db')
  const result = await bulkUpdateInvoiceStatus(
    db,
    session.tid,
    session.sub,
    parsed.data.ids,
    parsed.data.status,
    {
      countryCode,
      voidReason: parsed.data.voidReason,
    },
  )

  return c.json(result, 200)
})

// ── POST /bulk/customers/archive ──────────────────────────────────────────────

bulkRoutes.post('/customers/archive', requirePermission('customers:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = bulkCustomerArchiveSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const result = await bulkArchiveCustomers(db, session.tid, session.sub, parsed.data.ids)

  return c.json(result, 200)
})

// ── POST /bulk/expenses/delete ────────────────────────────────────────────────

bulkRoutes.post('/expenses/delete', requirePermission('expenses:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = bulkExpenseDeleteSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const result = await bulkDeleteExpenses(db, session.tid, session.sub, parsed.data.ids)

  return c.json(result, 200)
})

// ── POST /bulk/projects/status ────────────────────────────────────────────────

bulkRoutes.post('/projects/status', requirePermission('projects:write'), async (c) => {
  const session = c.get('session')
  if (!session || session.type !== 'user' || !session.tid) {
    return c.json({ error: 'Unauthorized' }, 401)
  }

  const parsed = bulkProjectStatusSchema.safeParse(await c.req.json())
  if (!parsed.success) {
    return c.json({ error: 'Validation failed', issues: parsed.error.issues }, 400)
  }

  const db = c.get('db')
  const result = await bulkUpdateProjectStatus(
    db,
    session.tid,
    session.sub,
    parsed.data.ids,
    parsed.data.status,
  )

  return c.json(result, 200)
})